CVE-2026-44496

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-44496) has been identified in Axios’s browser cookie-reading logic. Axios builds a regular expression from the configured xsrfCookieName without escaping regex metacharacters. If an attacker can influence this setting, a crafted value can trigger excessive backtracking when Axios reads document.cookie, consuming CPU time and potentially freezing the browser tab.

This behavior maps to CWE-1333 (Inefficient Regular Expression Complexity), where expensive regex evaluation consumes excessive CPU resources. The advisory also identifies CWE-400 (Uncontrolled Resource Consumption). In Axios, interpreting an attacker-controlled cookie name as regex syntax can cause a Regular Expression Denial of Service (ReDoS), impairing application responsiveness.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions: >=1.0.0, <1.16.0; <0.32.0
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • NES for Axios 0.24.2
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1

Vulnerability Info

This high-severity vulnerability affects browser applications that allow attacker-controlled input to reach Axios’s xsrfCookieName configuration or its internal cookie-reading helper. The GitHub advisory assigns a CVSS v3.1 score of 7.5.

A malicious cookie-name pattern can cause excessive regex backtracking during request preparation, blocking JavaScript execution and freezing the affected tab. Ordinary Node.js HTTP adapter usage is unaffected, as is the default static cookie name when attackers cannot influence it. The documented impact is limited to availability.

This behavior aligns with CWE-1333 (Inefficient Regular Expression Complexity) and CWE-400 (Uncontrolled Resource Consumption). Inefficient regex matching can require disproportionately large amounts of computation for particular inputs, exhausting CPU resources and preventing other work from progressing.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.